The router service will still be installed on the main BES, you can't prevent that. But you can disable the router service on the main BES. On the DMZ box, only the Router and the Controller services will be installed. Don't forget to point the main BES to the router in DMZ and remove the pointer to localhost.